# Release Notes - New Features & Bug Fixes

# 🛡️ EDR (Endpoint Detection & Response)

**✨ Enhancement**

- Add `query_policies` and `query_exclusions` support to the CrowdStrike EDR Provider. Exclusions are selected with `resource.type`: `path` (the default, covering Sensor Visibility and ML exclusions) or `process` (IOA exclusions). The integration's API client needs the Sensor Visibility Exclusions, ML Exclusions, IOA Exclusions, and Prevention Policies scopes.
- Make scheduled `query_threatevents` pulls incremental on `time` for CrowdStrike, Sophos, Bitdefender, ESET, and the other EDR providers that declare it, instead of re-pulling a full snapshot on every run. Defender and SentinelOne keep their update-time cursor, so status changes on known threats still flow.
- Make scheduled `query_endpoints` pulls incremental on Defender, Tanium, ESET, Iru, and Sophos by accepting `time` as an alias of the endpoint's last-seen time. Tanium `device.last_seen_time` now also accepts `gt`.
- Map agent version, managed state, network interfaces, model, vendor, CPU details, and group on Trellix and Trellix ENS `query_endpoints` and `get_endpoint`, derive `os.type_id` from the OS name, and populate `unmapped` with every source field the transform does not consume.
- Populate `unmapped` on Sophos applications, posture score, and threat events, so source fields the transform does not consume are passed through instead of dropped.


**🐛 Bug Fix**

- Fix CrowdStrike filters combining an `in` filter with another filter, such as `status_id[in]1,2` with `device.uid[eq]…`, matching records outside the other filter. Applies to alerts, endpoints, applications, IOAs, and policies.
- Fix CrowdStrike scheduled `query_threatevents` and `query_edr_events` runs failing with a `400` once offset paging reached CrowdStrike's 10,000-row limit. Paging now stops at the limit, and an operation already stuck past it recovers on its next run. If more than 10,000 alerts arrive between two runs, the excess is skipped and a warning is logged.
- Fix Sophos posture score reporting every device OS as Unknown, threat events always returning a null `attacks[].tactic.name`, and an empty `metadata.product.version`. OS is now mapped from the device platform, `attacks` is built from the MITRE tactics and techniques on the detection, and the product version comes from the sensor version.
- Fix alert and threat status mappings on Tanium, Trellix EDR, ESET, and SentinelOne, which reported several vendor states as Other or Unknown. ESET `CLOSED` incidents now read as Resolved, and the ESET Resolved filter no longer returns a `400`.
- Fix SentinelOne alert `severity` being reported as Other (`99`). Severity now comes from the rule severity, and the analyst verdict moves to `status_detail`; the alert `severity` filter still filters on the analyst verdict.
- Fix ESET alert severity reporting `MEDIUM` and `HIGH` detections as Unknown, and ESET alert queries intermittently failing with a `502` on slow responses.
- Fix Malwarebytes threat events returning an empty `finding_info.uid`, and Iru detections colliding across devices because `finding_info.uid` was the file hash. Malwarebytes `metadata.uid` is now the record ID, and its `metadata.uid` filter is removed.
- Fix Trellix `query_alerts` returning a `400` for a `time[lt]` filter older than about an hour when no lower bound is given.
- Fix ESET last-seen filters on `query_endpoints` dropping every device, and Sophos endpoint time filters applying every operator as a lower bound.
- Remove the `time`, `time_dt`, `finding_info.created_time`, and `finding_info.created_time_dt` filters from Trellix `query_threatevents`, which Trellix could not honor and which now return a `400`. Use `finding_info.modified_time_dt` (`gt`, `lt`) instead.


# 👤 Identity Management

**✨ Enhancement**

- Add `get_user_picture` support to the Microsoft Entra ID Identity Provider, returning a user's profile photo.


**🐛 Bug Fix**

- Fix Microsoft Entra ID `get_group_members` returning only the first page of members. The operation now returns a cursor for the next page.
- Return the user from Microsoft Entra ID `get_user` when the integration lacks the `UserAuthenticationMethod.Read.All` permission, with the MFA fields omitted and an advisory problem naming the missing permission, instead of failing the request.


# 🎫 Ticketing

**🐛 Bug Fix**

- Remove `eq` and `neq` from the Jira and Jira Service Management `query_tickets` datetime filters (`created_at`, `updated_at`, `due_date`, `completion_date`), which returned no rows because JQL compares datetimes only to the minute. These filters now return a `400`; `in` and `not in` now match the whole minute instead of failing with a `500`, and the capabilities document `like` as JQL's case-insensitive word search rather than a substring match.


# 💬 Chat

**✨ Enhancement**

- Identify the user on every Microsoft Copilot Chat message, mapping the user ID to `actor.user.uid`, the UPN to `actor.user.uid_alt`, and the email address to `actor.user.email_addr`. AI responses also carry the responding application in `actor.app_name` and `actor.app_uid`.


# 🌐 Network Security

**✨ Enhancement**

- Add the `query_firewall_rules` operation (`GET /v1/network-security/firewall-rules`) to the Network Security Connector, implemented for Google Cloud, AWS, and Azure. Each rule is returned as an OCSF Cloud Resources Inventory Info record in the provider's evaluation order: Google Cloud VPC, global, hierarchical, and regional firewall policy rules; AWS network ACL entries followed by security group rules; and Azure network security group rules. AWS integrations need `ec2:DescribeNetworkAcls`, `ec2:DescribeSecurityGroupRules`, and `ec2:DescribeSecurityGroups`.


**🐛 Bug Fix**

- Return the correct status for AWS errors on the Network Security Connector instead of a `500`: `403` for access denied, `429` for throttling, `404` for a missing bucket or log group, and `503` when the service is unavailable. The message keeps AWS's error text, such as the denied IAM action.


# 📊 SIEM & Sink

**🐛 Bug Fix**

- Fix Microsoft Sentinel `query_events` returning duplicate or missing events when a page boundary fell between events sharing the same timestamp. Large groups of events with one timestamp no longer return a `503`, and cursors issued before this change continue to work.


# ⚙️ Core

**🐛 Bug Fix**

- Prevent asynchronous operations from running against an integration of a different connector. `POST /v1/operations` now rejects an operation whose category does not match the integration's provider, and an integration can no longer be patched to a provider from another connector.
- Return a `400` naming `credential.type` and its valid values when an integration or credential request uses an unknown credential type, instead of a `500`.


# 🔌 MCP (Model Context Protocol)

**✨ Enhancement**

- Add Security Awareness Connector support to the Synqly MCP tools.
- Allow MCP clients to sign in to the Synqly Enterprise MCP server with OAuth, and list the applications connected this way under Settings → Connected applications.


# 📚 SDK Releases

**Latest Versions**

- Released Synqly SDK versions: `2.0.82`, `2.0.83`, `2.0.84`, `2.0.85`, `2.0.86`


# 🚢 Synqly Embedded

**✨ Enhancement**

- Add support for bring-your-own-key (BYOK) with Google Cloud KMS in Synqly Embedded.


**Latest Release: `v0.1.165`**

- **Service Image Tag**: `embedded-2026.10.19`
- **Service Image Tag (NO FIPS)**: `embedded-2026.10.19-no-fips`
- **Release Date**: October 19, 2026